     (some?
      (first
       (set/intersection
-       (cond (set? desired-capability) desired-capability
-             (keyword? desired-capability) #{desired-capability}
-             (sequential? desired-capability) (set desired-capability))
+       (as-set desired-capability)
        (auth/allowed-capabilities this))))))
 
 (defprotocol IWhoAmI

  (:require [cheshire.core :as json]
            [cia.auth :as auth]
            [cia.properties :refer [properties]]
            [cia.store :as store]
            [clj-http.client :as http]
            [clojure.core.memoize :as memo]
            [clojure.set :as set]
            [clojure.string :as str]))

(def cache-ttl-ms (* 1000 60 5))

(defrecord Identity [role login capabilities]
  auth/IIdentity

    (memo/ttl (make-whoami-fn url)
              :ttl/threshold cache-ttl-ms))))

(s/defn lookup-stored-identity :- (s/maybe id/Identity)
  [login :- s/Str]
  (store/read-identity @store/identity-store login))

(defrecord AuthService [whoami-service lookup-stored-identity-fn]
